Nairobi — The Office of the Data Protection Commissioner (ODPC) has issued 184 compensation orders to Kenyans affected by data breaches since the enactment of the Data Protection Act, 2019 (DPA).

Out of 9,061 complaints received, the office has also resolved 84 cases through the Alternative Dispute Resolution (ADR) framework.

The DPA, enacted to give effect to the right to privacy under Article 31(c) and (d) of the Constitution, is Kenya's primary law governing the collection, processing, and protection of personal data.

Follow us on WhatsApp | LinkedIn for the latest headlines

Under the law, individuals have the right to be informed about how their data is used, access their personal information, object to processing, and request the correction or deletion of inaccurate data.

The Act also requires data controllers and processors to register with the ODPC and comply with specific obligations before and after registration.

Entities that breach the law risk fines of up to Sh5 million, imprisonment of up to 10 years, or both.

"The ODPC has taken swift action on these complaints, issuing 357 determinations, 134 enforcement notices, and 20 penalty notices to ensure compliance with data protection regulations," Data Commissioner Immaculate Kassait said ahead of the 2026 Data Privacy Day Conference in Mombasa.

Kassait said the regulator has expanded its footprint to better serve Kenyans, with regional offices in Nairobi, Mombasa, Kisumu, Nakuru, Eldoret, Machakos, Garissa, and Nyeri.

"In 2024, we launched our second strategic plan for 2025-2029, focusing on strengthening data protection policies and regulations, enhancing institutional capacity, and increasing compliance with data protection laws," she said.

She added that the Compliance and Inspection Directorate has issued registration certificates to more than 15,000 entities, signalling adherence to data protection requirements.